AI KEY·发布前审一遍

• Outcome: Review
• Latest audit: Sep 23, 2026 · 4:13 AM UTC
• Version: 0.4.5

Overview

The skill is a coherent pre-publish script review tool, but it automatically stores user feedback and review memory without clear opt-in, limits, or deletion guidance.

Review this skill before installing if your drafts contain confidential strategy, client information, unpublished business plans, or sensitive editorial patterns. The review logic itself is coherent, but you should only use it if you are comfortable with automatic local vault and memory entries, or after disabling/gating those write-back instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill lists generic invocations such as “帮我审一下”, “审核”, and “review my script”, which are common phrases that could be said in many contexts unrelated to this specific skill. The description does not provide exclusion conditions or context limits, so the activation scope is ambiguous and may cause unintended invocation.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill directs automatic write-back of user feedback to a vault despite being presented as a script-review tool. Hidden persistence changes the trust boundary: users may provide unpublished copy, strategy, or business details expecting analysis only, but the skill instructs storing them without explicit consent or minimization.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The memory section instructs writing user corrections and recurring issues into persistent storage after use, which exceeds the stated review purpose. This creates a privacy and retention risk because interaction-derived information can be silently accumulated over time, including sensitive editorial preferences or unpublished content patterns.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Automatic long-term memory storage is not necessary to perform a one-off pre-publish script review and is not justified by the skill's stated purpose. Unnecessary persistence increases exposure of confidential drafts, strategic messaging, and user-specific weaknesses without a clear functional need.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instruction says user feedback should be automatically written back to storage, but it does not warn the user at the time of use. Lack of notice undermines informed consent and can lead to silent retention of sensitive unpublished material or business feedback.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Automatic logging of user feedback into persistent storage lacks clear minimization boundaries, so the skill could capture more than is needed for its function. In this context, scripts may contain unpublished commercial plans, audience strategy, or regulated claims, making over-collection more sensitive.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes this as a pre-publish review skill that is 'Diagnose-only by default.' However, the body instructions mandate that every red-line hit must include directly replaceable rewritten text, including two rewrite variants, and explicitly forbid 'only marking without revising.' That goes beyond default diagnosis into mandatory content editing behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The memory-write instruction persists information from interactions without a clear user warning. Even if intended for quality improvement, silent persistence of corrections and repeated weaknesses is risky because users may not expect durable profiling from a review skill.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to record user corrections and recurring issues creates a durable profile of the user's patterns without clear limits on scope, retention, or sensitivity. Because this is a content-review skill, those notes can reveal internal strategy, repeated compliance weak spots, or unpublished messaging tendencies over time.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The entire skill/report content is written as if interaction and output are expected in Chinese, with no indication that the user may choose another language. This can violate language/locale policy when a skill imposes a language without explicit user opt-in or documented regional justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document includes explicit off-platform contact directions such as private messaging, adding a WeChat ID, and visiting the homepage to obtain a pricing sheet. In a review skill, this is risky because it normalizes routing users off-platform without any privacy, impersonation, or data-handling warning, which can facilitate untracked solicitation or collection of personal contact details.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script explicitly asks viewers to move off-platform via private messages or WeChat and publishes a direct contact handle. This creates privacy, impersonation, and unmonitored solicitation risk, especially in a monetized 'knowledge payment' context where users may be funneled into sales or data collection outside platform safeguards.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction '必须报到' and the surrounding Chinese-only scoring guidance indicate a fixed language/locale expectation for the skill artifact. The file does not offer any language choice or explain why Chinese is required, which matches the policy category for language or locale constraints without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Lines L225-L233 require public-facing tutorial content to switch to domestic models and forbid guiding users to use overseas models, presenting this as a hard policy rather than a user choice. This is a natural-language locale/policy constraint that does not offer opt-in, alternatives, or user preference handling.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: All user-facing natural-language content in the file is Chinese, and there is no indication that the user can opt into this language or that the skill is intentionally restricted to a Chinese-speaking context. Under SQP-3, forcing a specific language without user opt-in can be a policy violation.

Static analysis

No suspicious patterns detected.